Trojaner-Board - regsvr32: Fehler beim Laden des Moduls "c:\ProgramData\ptqnaw.dat

Hallo Mathias,

vielen Dank für Deine schnelle Antwort.

Hier kommt die Combofix.txt

Code:

ComboFix 14-05-29.01 - ****** 30.05.2014  17:41:26.1.4 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8051.5814 [GMT 2:00]

ausgeführt von:: c:\users\g÷hring\Desktop\ComboFix.exe

AV: G Data AntiVirus 2011 *Disabled/Updated* {54ACC2FC-837E-E665-7A92-5352D560D5EF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-04-28 bis 2014-05-30  ))))))))))))))))))))))))))))))

.

.

2014-05-30 15:53 . 2014-05-30 15:53        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-05-30 13:38 . 2014-05-30 13:39        --------        d-----w-        C:\FRST

2014-05-30 13:21 . 2014-04-30 23:20        10702536        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D747A104-9107-40C2-A1DB-9B22343067F5}\mpengine.dll

2014-05-27 15:10 . 2014-05-28 12:36        --------        d-----w-        c:\users\********\AppData\Local\TGitCache

2014-05-14 15:58 . 2014-05-06 04:40        23544320        ----a-w-        c:\windows\system32\mshtml.dll

2014-05-14 15:58 . 2014-05-06 03:00        84992        ----a-w-        c:\windows\system32\mshtmled.dll

2014-05-14 15:58 . 2014-05-06 04:17        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2014-05-14 15:58 . 2014-05-06 03:07        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2014-05-14 15:58 . 2014-05-14 15:58        --------        d-----w-        c:\program files\Common Files\DESIGNER

2014-05-14 13:15 . 2014-05-14 13:15        --------        d-----w-        c:\program files\Microsoft Network Monitor 3

2014-05-06 15:24 . 2014-05-15 06:30        --------        d-s---w-        c:\windows\system32\CompatTel

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-05-30 15:33 . 2013-06-20 15:32        106224        ----a-w-        c:\windows\SysWow64\drivers\GRD.sys

2014-05-14 15:56 . 2013-06-20 12:31        93223848        ----a-w-        c:\windows\system32\MRT.exe

2014-04-25 13:38 . 2013-08-27 14:06        70832        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-04-25 13:38 . 2013-08-27 14:06        692400        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-03-31 07:35 . 2010-11-21 03:27        270496        ------w-        c:\windows\system32\MpSigStub.exe

2014-03-06 09:31 . 2014-04-29 10:51        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2014-03-06 08:59 . 2014-04-29 10:51        66048        ----a-w-        c:\windows\system32\iesetup.dll

2014-03-06 08:57 . 2014-04-29 10:51        548352        ----a-w-        c:\windows\system32\vbscript.dll

2014-03-06 08:57 . 2014-04-29 10:51        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2014-03-06 08:53 . 2014-04-29 10:51        2767360        ----a-w-        c:\windows\system32\iertutil.dll

2014-03-06 08:40 . 2014-04-29 10:51        51200        ----a-w-        c:\windows\system32\jsproxy.dll

2014-03-06 08:39 . 2014-04-29 10:51        33792        ----a-w-        c:\windows\system32\iernonce.dll

2014-03-06 08:32 . 2014-04-29 10:51        574976        ----a-w-        c:\windows\system32\ieui.dll

2014-03-06 08:29 . 2014-04-29 10:51        139264        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-03-06 08:29 . 2014-04-29 10:51        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe

2014-03-06 08:28 . 2014-04-29 10:51        752640        ----a-w-        c:\windows\system32\jscript9diag.dll

2014-03-06 08:15 . 2014-04-29 10:51        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2014-03-06 08:11 . 2014-04-29 10:51        5784064        ----a-w-        c:\windows\system32\jscript9.dll

2014-03-06 08:09 . 2014-04-29 10:51        453120        ----a-w-        c:\windows\system32\dxtmsft.dll

2014-03-06 08:03 . 2014-04-29 10:51        586240        ----a-w-        c:\windows\system32\ie4uinit.exe

2014-03-06 08:02 . 2014-04-29 10:51        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll

2014-03-06 08:02 . 2014-04-29 10:51        455168        ----a-w-        c:\windows\SysWow64\vbscript.dll

2014-03-06 08:01 . 2014-04-29 10:51        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll

2014-03-06 07:56 . 2014-04-29 10:51        38400        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll

2014-03-06 07:48 . 2014-04-29 10:51        195584        ----a-w-        c:\windows\system32\msrating.dll

2014-03-06 07:46 . 2014-04-29 10:51        4254720        ----a-w-        c:\windows\SysWow64\jscript9.dll

2014-03-06 07:42 . 2014-04-29 10:51        296960        ----a-w-        c:\windows\system32\dxtrans.dll

2014-03-06 07:38 . 2014-04-29 10:51        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-03-06 07:36 . 2014-04-29 10:51        592896        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2014-03-06 07:21 . 2014-04-29 10:51        628736        ----a-w-        c:\windows\system32\msfeeds.dll

2014-03-06 07:13 . 2014-04-29 10:51        32256        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2014-03-06 07:11 . 2014-04-29 10:51        2043904        ----a-w-        c:\windows\system32\inetcpl.cpl

2014-03-06 06:53 . 2014-04-29 10:51        13551104        ----a-w-        c:\windows\system32\ieframe.dll

2014-03-06 06:40 . 2014-04-29 10:51        1967104        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2014-03-06 06:22 . 2014-04-29 10:51        2260480        ----a-w-        c:\windows\system32\wininet.dll

2014-03-06 05:58 . 2014-04-29 10:51        1400832        ----a-w-        c:\windows\system32\urlmon.dll

2014-03-06 05:50 . 2014-04-29 10:51        846336        ----a-w-        c:\windows\system32\ieapfltr.dll

2014-03-06 05:41 . 2014-04-29 10:51        1789440        ----a-w-        c:\windows\SysWow64\wininet.dll

2014-03-04 09:44 . 2014-04-09 07:28        362496        ----a-w-        c:\windows\system32\wow64win.dll

2014-03-04 09:44 . 2014-04-09 07:28        243712        ----a-w-        c:\windows\system32\wow64.dll

2014-03-04 09:44 . 2014-04-09 07:28        13312        ----a-w-        c:\windows\system32\wow64cpu.dll

2014-03-04 09:44 . 2014-04-09 07:28        16384        ----a-w-        c:\windows\system32\ntvdm64.dll

2014-03-04 09:44 . 2014-04-09 07:28        1163264        ----a-w-        c:\windows\system32\kernel32.dll

2014-03-04 09:17 . 2014-04-09 07:28        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll

2014-03-04 09:17 . 2014-04-09 07:28        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2014-03-04 09:16 . 2014-04-09 07:28        25600        ----a-w-        c:\windows\SysWow64\setup16.exe

2014-03-04 09:16 . 2014-04-09 07:27        5120        ----a-w-        c:\windows\SysWow64\wow32.dll

2014-03-04 08:09 . 2014-04-09 07:27        7680        ----a-w-        c:\windows\SysWow64\instnm.exe

2014-03-04 08:09 . 2014-04-09 07:27        2048        ----a-w-        c:\windows\SysWow64\user.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]

@="{C5994561-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]

@="{C5994562-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]

@="{C5994563-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]

@="{C5994564-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]

@="{C5994565-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]

@="{C5994566-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]

@="{C5994567-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]

@="{C5994568-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        64792        ----a-w-        c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe" [2010-08-27 996936]

"Adobe Photo Downloader"="c:\program files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]

"SMB60StarMoneyRunEntry"="c:\program files (x86)\StarMoney Business 6.0\app\oflagent.exe" [2014-04-07 48272]

"Acrobat Assistant 7.0"="c:\program files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

.

c:\users\********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Persbackup.lnk - c:\program files\Personal Backup 5\Persbackup.exe /auto [2013-7-2 8430592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-100000000002}\SC_Acrobat.exe [2014-2-11 25214]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys;c:\windows\SYSNATIVE\drivers\GRD.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\FUJ02E3.sys;c:\windows\SYSNATIVE\drivers\FUJ02E3.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]

S1 gdwfpcd;G DATA WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys;c:\windows\SYSNATIVE\drivers\gdwfpcd64.sys [x]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]

S1 nm3;Microsoft Network Monitor 3 Driver;c:\windows\system32\DRIVERS\nm3.sys;c:\windows\SYSNATIVE\DRIVERS\nm3.sys [x]

S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]

S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [x]

S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\AntiVirus\AVK\AVKService.exe;c:\program files (x86)\G Data\AntiVirus\AVK\AVKService.exe [x]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe;c:\program files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [x]

S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]

S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]

S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]

S2 StarMoney Business 6.0 OnlineUpdate;StarMoney Business 6.0 OnlineUpdate;c:\program files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [x]

S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]

S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]

S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2014-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000Core.job

- c:\users\********\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-26 12:51]

.

2014-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000UA.job

- c:\users\********\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-26 12:51]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]

@="{C5994561-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]

@="{C5994562-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]

@="{C5994563-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]

@="{C5994564-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]

@="{C5994565-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]

@="{C5994566-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]

@="{C5994567-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]

@="{C5994568-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]

2011-06-13 08:20        75544        ----a-w-        c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-26 170264]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-26 398616]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-26 439064]

"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-02-20 456704]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Auswahl in Adobe PDF konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: In vorhandene PDF-Datei konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

TCP: DhcpNameServer = 192.168.20.1

FF - ProfilePath - c:\users\********\AppData\Roaming\Mozilla\Firefox\Profiles\bs474uat.default\

.

.

------- Dateityp-Verknüpfung -------

.

txtfile="c:\program files (x86)\PSPad editor\PSPad.exe" "%1"

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-ptqnaw - c:\programdata\ptqnaw.dat

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.bmp.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.bmp.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.ico.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.jpg.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.jpg.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.jpg.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.jpg.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.png.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.tif.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.tif.15.4"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLive.PhotoGallery.wdp.15.4"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-05-30  18:02:25

ComboFix-quarantined-files.txt  2014-05-30 16:02

.

Vor Suchlauf: 11 Verzeichnis(se), 410.057.936.896 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 410.783.608.832 Bytes frei

.

- - End Of File - - FB134216065F5D1F382AAD8E89EF667A

Servus Mathias,

die Fehlermeldung kommt jetzt tatsächlich nicht mehr und auch die Datei "ptqnaw.dat" ist im Ordner c:\programData bisher nicht mehr aufgetaucht.

Ich hab FRST nochmal laufen lassen, hier die Logs:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014 01

Ran by ********** (administrator) on ************ on 02-06-2014 14:05:36

Running from C:\Users\**********\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe

() C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe

(G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe

(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

(J. Rathlev, IEAP, Uni-Kiel) C:\Program Files\Personal Backup 5\Persbackup.exe

(G Data Software AG) C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\acrotray.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()

HKLM-x32\...\Run: [G Data AntiVirus Tray Application] => C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe [996936 2010-08-27] (G Data Software AG)

HKLM-x32\...\Run: [Adobe Photo Downloader] => C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe [67488 2007-09-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SMB60StarMoneyRunEntry] => C:\Program Files (x86)\StarMoney Business 6.0\app\oflagent.exe [48272 2014-04-07] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

HKLM-x32\...\Run: [Acrobat Assistant 7.0] => C:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [483328 2004-12-14] (Adobe Systems Inc.)

HKLM-x32\...\Run: [] => [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-3082415708-4282982959-2965814243-1000\...\Run: [Google Update] => C:\Users\**********\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-26] (Google Inc.)

HKU\S-1-5-21-3082415708-4282982959-2965814243-1000\...\Run: [EPSON B-510DN] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFKE.EXE [224256 2009-05-29] (SEIKO EPSON CORPORATION)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk

ShortcutTarget: Adobe Acrobat - Schnellstart.lnk -> C:\Windows\Installer\{AC76BA86-1033-F400-7760-100000000002}\SC_Acrobat.exe ()

Startup: C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk

ShortcutTarget: Persbackup.lnk -> C:\Program Files\Personal Backup 5\Persbackup.exe (J. Rathlev, IEAP, Uni-Kiel)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.fujitsu.com/fts

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.fujitsu.com/fts

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.com/ig/redirectdomain?brand=FTSH&bmod=FTSH

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSH&bmod=FTSH

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {9186E4C6-A74D-4655-88F8-D8B604ED02D3} URL = 

SearchScopes: HKCU - {9186E4C6-A74D-4655-88F8-D8B604ED02D3} URL = 

BHO: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\Webfilter\AVKWebIEx64.dll (G Data Software AG)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\WebFilter\AvkWebIE.dll (G Data Software AG)

BHO-x32: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

Toolbar: HKLM - G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\Webfilter\AVKWebIEx64.dll (G Data Software AG)

Toolbar: HKLM-x32 - G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\AntiVirus\WebFilter\AvkWebIE.dll (G Data Software AG)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Hosts: 192.168.20.60 **********-dev.ixsys.de

Tcpip\Parameters: [DhcpNameServer] 192.168.20.1
 

FireFox:

========

FF ProfilePath: C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\7zhgho9q.default

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\**********\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\**********\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Firebug - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\7zhgho9q.default\Extensions\firebug@software.joehewitt.com.xpi [2013-06-25]

FF Extension: Toggle Mixed Active Content - C:\Users\**********\AppData\Roaming\Mozilla\Firefox\Profiles\7zhgho9q.default\Extensions\jid0-LfpuGtyvjqw5JxLBjdCjX5Fzorw@jetpack.xpi [2013-08-30]
 

Chrome: 

=======

CHR Plugin: (Shockwave Flash) - C:\Users\**********\AppData\Local\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\**********\AppData\Local\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\**********\AppData\Local\Google\Chrome\Application\35.0.1916.114\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Users\**********\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File

CHR Extension: (Google Docs) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-26]

CHR Extension: (Google Drive) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-26]

CHR Extension: (YouTube) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-26]

CHR Extension: (Google-Suche) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-26]

CHR Extension: (Google Wallet) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]

CHR Extension: (Google Mail) - C:\Users\**********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-26]
 

==================== Services (Whitelisted) =================
 

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1178184 2010-08-27] (G Data Software AG)

R2 AVKService; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe [410696 2010-08-27] (G Data Software AG)

R2 AVKWCtl; C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [1865344 2010-08-27] ()

R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)

R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [340552 2010-08-27] (G Data Software AG)

R2 StarMoney Business 6.0 OnlineUpdate; C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2014-01-27] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

S2 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)

S3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [40392 2013-06-19] (G Data Software AG)

R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [85960 2013-06-19] (G Data Software AG)

R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [48584 2013-06-19] (G DATA Software AG)

S1 GRD; C:\Windows\SysWOW64\drivers\GRD.sys [106224 2014-05-30] (G Data Software)

R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [49096 2013-06-19] (G Data Software AG)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 CnxtHdAudService; system32\drivers\CHDRT64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-02 14:05 - 2014-06-02 14:05 - 00013732 _____ () C:\Users\**********\Desktop\FRST.txt

2014-06-02 14:05 - 2014-06-02 14:05 - 00000000 ____D () C:\Users\**********\Desktop\FRST-OlderVersion

2014-06-02 14:03 - 2014-06-02 14:05 - 02067456 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe

2014-05-30 18:25 - 2014-05-30 18:28 - 00000000 ____D () C:\Users\**********\Desktop\troj-rem

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\randelshofer\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Public\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\mathias\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\fritz\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Default\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp

2014-05-30 17:38 - 2014-05-30 18:02 - 00000000 ____D () C:\Qoobox

2014-05-30 17:38 - 2014-05-30 17:58 - 00000000 ____D () C:\Windows\erdnt

2014-05-30 17:38 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-05-30 17:38 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-05-30 17:38 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-05-30 17:38 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-05-30 17:38 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-05-30 17:38 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-05-30 17:38 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-05-30 17:38 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-05-30 15:39 - 2014-05-30 17:38 - 00028033 _____ () C:\Users\**********\Downloads\Addition.txt

2014-05-30 15:38 - 2014-06-02 14:05 - 00000000 ____D () C:\FRST

2014-05-30 15:38 - 2014-05-30 17:38 - 00029733 _____ () C:\Users\**********\Downloads\FRST.txt

2014-05-30 15:36 - 2014-05-30 15:36 - 02066944 _____ (Farbar) C:\Users\**********\Downloads\FRST64.exe

2014-05-28 17:58 - 2014-05-28 17:58 - 00039106 _____ () C:\Users\**********\Desktop\DOKU_Nachbearbeitung_Inhalte-nach-Umzug-vor-Relaunch_mp-1.xlsx

2014-05-28 17:56 - 2014-05-28 17:57 - 00000100 _____ () C:\Users\**********\Desktop\delete-div-query.txt

2014-05-27 17:17 - 2014-05-27 17:22 - 03145728 _____ () C:\Users\**********\Downloads\msert.exe

2014-05-27 17:10 - 2014-05-28 14:36 - 00000000 ____D () C:\Users\**********\AppData\Local\TGitCache

2014-05-27 15:47 - 2014-05-27 16:40 - 105232152 _____ (Microsoft Corporation) C:\Users\**********\Desktop\msert.exe

2014-05-27 14:55 - 2014-05-27 18:48 - 00030059 _____ () C:\Users\**********\Desktop\Ticket-768-Seiten-ueberarbeiten.xlsx

2014-05-23 15:11 - 2014-05-23 17:29 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-768

2014-05-14 17:58 - 2014-05-14 17:58 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER

2014-05-14 17:58 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-14 17:58 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-14 17:58 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-14 17:58 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-14 17:58 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-14 17:58 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-14 15:15 - 2014-05-14 15:15 - 00001022 _____ () C:\Users\Public\Desktop\Microsoft Network Monitor 3.4.lnk

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\Users\**********\Documents\Network Monitor 3

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Network Monitor 3.4

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\Program Files\Microsoft Network Monitor 3

2014-05-14 15:12 - 2014-05-14 15:12 - 06837560 _____ (Microsoft Corporation) C:\Users\**********\Downloads\NM34_x64.exe

2014-05-14 12:13 - 2014-05-20 12:11 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-672

2014-05-14 09:22 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-14 09:22 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-14 09:22 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-05-14 09:22 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-05-14 09:22 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-05-14 09:22 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-05-14 09:22 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-05-14 09:22 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-05-14 09:22 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-05-14 09:22 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-05-14 09:22 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-05-14 09:22 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 09:22 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 09:22 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-05-14 09:22 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-05-14 09:22 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-05-14 09:22 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-05-14 09:22 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-05-14 09:22 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-05-14 09:22 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-05-14 09:22 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-05-14 09:22 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-05-14 09:22 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-05-13 17:38 - 2014-05-14 17:22 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-774-Formatierungs-Schrotteingaben

2014-05-13 15:51 - 2014-05-13 15:51 - 00000086 _____ () C:\Users\**********\Desktop\upadete_oerms_groupid.txt

2014-05-12 15:38 - 2014-05-12 15:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-05-09 15:59 - 2014-05-14 16:33 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-680-Breite-Bilder

2014-05-09 14:45 - 2014-05-09 17:58 - 00004247 _____ () C:\Users\**********\Desktop\Query-Therapeutenlist.csv

2014-05-07 16:46 - 2014-05-07 16:46 - 00004884 _____ () C:\Users\**********\Desktop\tt_content_haendischer_style.csv

2014-05-06 17:24 - 2014-05-15 08:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
 

==================== One Month Modified Files and Folders =======
 

2014-06-02 14:05 - 2014-06-02 14:05 - 00013732 _____ () C:\Users\**********\Desktop\FRST.txt

2014-06-02 14:05 - 2014-06-02 14:05 - 00000000 ____D () C:\Users\**********\Desktop\FRST-OlderVersion

2014-06-02 14:05 - 2014-06-02 14:03 - 02067456 _____ (Farbar) C:\Users\**********\Desktop\FRST64.exe

2014-06-02 14:05 - 2014-05-30 15:38 - 00000000 ____D () C:\FRST

2014-06-02 14:05 - 2013-06-19 17:13 - 00000000 ____D () C:\Users\**********\AppData\Local\Temp

2014-06-02 14:04 - 2013-06-20 02:01 - 02092792 _____ () C:\Windows\WindowsUpdate.log

2014-06-02 13:59 - 2014-01-13 15:18 - 00011301 _____ () C:\Windows\setupact.log

2014-06-02 13:59 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-30 18:30 - 2013-08-26 17:48 - 00000000 ____D () C:\Users\**********\AppData\Local\TGitCache

2014-05-30 18:28 - 2014-05-30 18:25 - 00000000 ____D () C:\Users\**********\Desktop\troj-rem

2014-05-30 18:24 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-30 18:24 - 2009-07-14 06:45 - 00016768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-30 18:18 - 2013-09-04 11:39 - 00000000 ____D () C:\Users\**********\AppData\Local\Temp

2014-05-30 18:16 - 2014-01-13 15:17 - 00162068 _____ () C:\Windows\PFRO.log

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\randelshofer\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Public\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\mathias\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\fritz\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Default\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 18:02 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp

2014-05-30 18:02 - 2014-05-30 17:38 - 00000000 ____D () C:\Qoobox

2014-05-30 17:58 - 2014-05-30 17:38 - 00000000 ____D () C:\Windows\erdnt

2014-05-30 17:53 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-05-30 17:38 - 2014-05-30 15:39 - 00028033 _____ () C:\Users\**********\Downloads\Addition.txt

2014-05-30 17:38 - 2014-05-30 15:38 - 00029733 _____ () C:\Users\**********\Downloads\FRST.txt

2014-05-30 17:33 - 2013-06-20 17:32 - 00106224 _____ (G Data Software) C:\Windows\SysWOW64\Drivers\GRD.sys

2014-05-30 17:32 - 2013-08-26 14:51 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000UA.job

2014-05-30 15:36 - 2014-05-30 15:36 - 02066944 _____ (Farbar) C:\Users\**********\Downloads\FRST64.exe

2014-05-30 14:43 - 2013-10-18 15:06 - 00000000 ____D () C:\Users\**********\Downloads\alter-kram

2014-05-28 18:22 - 2013-08-26 15:35 - 00000000 ____D () C:\Users\**********\Downloads\**********_Dev

2014-05-28 18:22 - 2013-07-05 17:10 - 00000000 ____D () C:\Users\**********\.VirtualBox

2014-05-28 17:58 - 2014-05-28 17:58 - 00039106 _____ () C:\Users\**********\Desktop\DOKU_Nachbearbeitung_Inhalte-nach-Umzug-vor-Relaunch_mp-1.xlsx

2014-05-28 17:57 - 2014-05-28 17:56 - 00000100 _____ () C:\Users\**********\Desktop\delete-div-query.txt

2014-05-28 14:36 - 2014-05-27 17:10 - 00000000 ____D () C:\Users\**********\AppData\Local\TGitCache

2014-05-28 14:32 - 2013-08-26 14:51 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000Core.job

2014-05-28 13:06 - 2013-11-08 11:57 - 00000000 ____D () C:\Users\**********\Documents\Bank

2014-05-28 13:01 - 2014-01-27 17:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney Business 6.0

2014-05-27 18:48 - 2014-05-27 14:55 - 00030059 _____ () C:\Users\**********\Desktop\Ticket-768-Seiten-ueberarbeiten.xlsx

2014-05-27 17:22 - 2014-05-27 17:17 - 03145728 _____ () C:\Users\**********\Downloads\msert.exe

2014-05-27 16:40 - 2014-05-27 15:47 - 105232152 _____ (Microsoft Corporation) C:\Users\**********\Desktop\msert.exe

2014-05-27 15:44 - 2011-02-11 16:47 - 00701310 _____ () C:\Windows\system32\perfh007.dat

2014-05-27 15:44 - 2011-02-11 16:47 - 00150210 _____ () C:\Windows\system32\perfc007.dat

2014-05-27 15:44 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-05-26 12:48 - 2013-10-02 11:00 - 00000000 ____D () C:\Users\**********\Documents\Rechnungen

2014-05-23 17:29 - 2014-05-23 15:11 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-768

2014-05-23 15:19 - 2014-02-21 18:37 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-643-PagesUndContent

2014-05-21 12:24 - 2013-11-13 14:07 - 00000000 ____D () C:\Users\**********\Documents\mahnungen

2014-05-20 12:11 - 2014-05-14 12:13 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-672

2014-05-16 17:39 - 2014-02-21 18:31 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-756-Quellenangaben

2014-05-15 14:21 - 2013-06-28 15:57 - 00000000 ___RD () C:\Users\**********\Virtual Machines

2014-05-15 14:21 - 2013-06-19 17:15 - 00000000 ___RD () C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-15 14:21 - 2013-06-19 17:15 - 00000000 ___RD () C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-15 09:09 - 2013-09-04 11:40 - 00000000 ___RD () C:\Users\**********\Virtual Machines

2014-05-15 09:09 - 2013-09-04 11:40 - 00000000 ___RD () C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-15 09:09 - 2013-09-04 11:40 - 00000000 ___RD () C:\Users\**********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-15 09:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-15 08:30 - 2014-05-06 17:24 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-15 08:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-05-14 17:59 - 2013-06-20 15:41 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-05-14 17:58 - 2014-05-14 17:58 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER

2014-05-14 17:57 - 2013-08-16 14:38 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-14 17:56 - 2013-06-20 14:31 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-05-14 17:22 - 2014-05-13 17:38 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-774-Formatierungs-Schrotteingaben

2014-05-14 16:33 - 2014-05-09 15:59 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-680-Breite-Bilder

2014-05-14 15:15 - 2014-05-14 15:15 - 00001022 _____ () C:\Users\Public\Desktop\Microsoft Network Monitor 3.4.lnk

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\Users\**********\Documents\Network Monitor 3

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Network Monitor 3.4

2014-05-14 15:15 - 2014-05-14 15:15 - 00000000 ____D () C:\Program Files\Microsoft Network Monitor 3

2014-05-14 15:12 - 2014-05-14 15:12 - 06837560 _____ (Microsoft Corporation) C:\Users\**********\Downloads\NM34_x64.exe

2014-05-13 15:57 - 2014-04-23 16:53 - 00000000 ____D () C:\Users\**********\Desktop\Ticket-672-einfache-br-tags

2014-05-13 15:51 - 2014-05-13 15:51 - 00000086 _____ () C:\Users\**********\Desktop\upadete_oerms_groupid.txt

2014-05-13 09:09 - 2013-06-19 18:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-05-12 15:38 - 2014-05-12 15:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-05-12 14:27 - 2013-08-26 14:51 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000UA

2014-05-12 14:27 - 2013-08-26 14:51 - 00003712 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000Core

2014-05-09 17:58 - 2014-05-09 14:45 - 00004247 _____ () C:\Users\**********\Desktop\Query-Therapeutenlist.csv

2014-05-09 08:14 - 2014-05-14 09:22 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-09 08:11 - 2014-05-14 09:22 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-07 16:46 - 2014-05-07 16:46 - 00004884 _____ () C:\Users\**********\Desktop\tt_content_haendischer_style.csv

2014-05-06 14:02 - 2014-03-24 18:21 - 00000000 ____D () C:\ProgramData\windata

2014-05-06 14:02 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-06 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help

2014-05-06 06:40 - 2014-05-14 17:58 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-06 06:17 - 2014-05-14 17:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-06 05:25 - 2014-05-14 17:58 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-06 05:07 - 2014-05-14 17:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-06 05:00 - 2014-05-14 17:58 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-06 04:10 - 2014-05-14 17:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-05 10:02 - 2013-08-16 12:44 - 00000072 _____ () C:\Users\Public\LMDebug.log

2014-05-05 08:59 - 2013-11-11 10:29 - 00000000 ____D () C:\Users\**********\Documents\Faxe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-20 09:12
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2014 01

Ran by ********** at 2014-06-02 14:06:12

Running from C:\Users\**********\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: G Data AntiVirus 2011 (Disabled - Up to date) {54ACC2FC-837E-E665-7A92-5352D560D5EF}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Acrobat 7.0 Professional - English, Français, Deutsch (HKLM-x32\...\Adobe Acrobat 7.0 Professional - English, Français, Deutsch - V) (Version: 7.0.0 - Adobe Systems)

Adobe Acrobat 7.0 Professional - English, Français, Deutsch (x32 Version: 7.0.0 - Adobe Systems) Hidden

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Photoshop Elements 6.0 (HKLM-x32\...\Adobe Photoshop Elements 6) (Version: 6.0 - Adobe Systems, Inc.)

Adobe Photoshop Elements 6.0 (x32 Version: 6.0 - Adobe Systems, Inc.) Hidden

Adobe Reader XI (11.0.03) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)

CCleaner (HKLM\...\CCleaner) (Version: 4.04 - Piriform)

Common Desktop Agent (Version: 1.62.0 - OEM) Hidden

cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.7 - REINER SCT)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{F2CE207D-C146-4BFD-A1C2-219483C58819}) (Version:  - Microsoft)

Druckerdeinstallation für EPSON B-510DN (HKLM\...\EPSON B-510DN) (Version:  - SEIKO EPSON Corporation)

EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)

FileZilla Client 3.7.1.1 (HKLM-x32\...\FileZilla Client) (Version: 3.7.1.1 - Tim Kosse)

FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)

G Data AntiVirus 2011 (HKLM-x32\...\{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}) (Version: 21.0.0.0 - G Data Software AG)

Git version 1.8.3-preview20130601 (HKLM-x32\...\Git_is1) (Version: 1.8.3-preview20130601 - The Git Development Community)

Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Macromedia Dreamweaver 8 (HKLM-x32\...\{0837A661-FEC3-48B3-876C-91E7D32048A9}) (Version: 8.0.0.2734 - Macromedia)

Macromedia Extension Manager (HKLM-x32\...\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}) (Version: 1.7.240 - Macromedia, Inc.)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Network Monitor 3.4 (HKLM\...\{8C5B5A11-CBF8-451B-B201-77FAB0D0B77D}) (Version: 3.4.2350.0 - Microsoft Corporation)

Microsoft Network Monitor: NetworkMonitor Parsers 3.4 (HKLM\...\{963E5FEB-1367-46B9-851D-A957F1A3747F}) (Version: 3.4.2350.0 - Microsoft Corporation)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

Opera Stable 16.0.1196.62 (HKLM-x32\...\Opera 16.0.1196.62) (Version: 16.0.1196.62 - Opera Software ASA)

Oracle VM VirtualBox 4.2.16 (HKLM\...\{4CC3444D-7279-4E83-984F-18E9A7B2E803}) (Version: 4.2.16 - Oracle Corporation)

Personal Backup 5.4 (HKLM\...\Personal Backup 5_is1) (Version: 5.3 - J. Rathlev)

PSPad editor (HKLM-x32\...\PSPad editor_is1) (Version: 4.5.7.2450 - Jan Fiala)

Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.02.71.00(09.10.2012) - Samsung Electronics Co., Ltd.)

Samsung ML-371x Series (HKLM-x32\...\Samsung ML-371x Series) (Version: 1.26 (18.10.2012) - Samsung Electronics Co., Ltd.)

Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden

SmartGit/Hg 4.6.2 (HKLM-x32\...\SmartGit/Hg 4.6_is1) (Version:  - syntevo GmbH)

StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden

StarMoney (x32 Version: 4.0.3.24 - StarFinanz) Hidden

StarMoney Business 6.0  (HKLM-x32\...\{A3B526A8-1BB1-4841-AC53-3682A3D718EA}) (Version: 6.0 - Star Finanz GmbH)

TortoiseGit 1.8.5.0 (64 bit) (HKLM\...\{B00ED640-FA16-4EA9-9326-E0947E475D85}) (Version: 1.8.5.0 - TortoiseGit)

Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2878281) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{84B191B5-5319-463A-A305-8C4D53B1D20A}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{DB0B0CDF-77EC-47B0-94E2-4738573A1E58}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{EBD18DE5-BC84-4B57-9A30-097044871F9A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825635) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{6E760BBA-B83F-4C2D-918F-5F91EF6C9861}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-0407-1000-0000000FF1CE}_Office14.SingleImage_{64D96F30-CF4C-4CCE-AAF2-F8909348BF35}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.SingleImage_{9F6507AC-7D8F-46C1-B90F-59C7828E0E0D}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-001A-0407-1000-0000000FF1CE}_Office14.SingleImage_{6164E0E5-C903-488C-93AF-1B7AF7EBC331}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{DDDC32A5-9528-4771-B91A-97A8E1D7957B}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 64-Bit Edition (HKLM\...\{90140000-0018-0407-1000-0000000FF1CE}_Office14.SingleImage_{FD360122-6829-4497-97C1-1BF578EF695B}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A20A650C-F820-4CE4-AEA5-EC140192FAFB}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)

Update for Microsoft Visio 2010 (KB2880526) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{F6F342A1-530B-4D48-A468-1E3F70928984}) (Version:  - Microsoft)

Update for Microsoft Visio Viewer 2010 (KB2837587) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{C950A55F-82E3-4CC8-8FA2-E8A2A0F651F3}) (Version:  - Microsoft)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)
 

==================== Restore Points  =========================
 

27-05-2014 14:00:06 Windows-Sicherung

30-05-2014 13:20:47 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-01-10 18:19 - 00000900 ____A C:\Windows\system32\Drivers\etc\hosts

192.168.20.60 **********-dev.ixsys.de
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {279A2595-95D1-4F43-BBD1-F808E4570E43} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)

Task: {AA6270FE-F748-4D6A-810D-22256EE19283} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000UA => C:\Users\**********\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-26] (Google Inc.)

Task: {B6EC5D30-F9C5-448C-AB3E-6280EE1C6806} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {E8BC3A08-12B4-473D-8467-3F88532CE32B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000Core => C:\Users\**********\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-26] (Google Inc.)

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000Core.job => C:\Users\**********\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3082415708-4282982959-2965814243-1000UA.job => C:\Users\**********\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2010-08-27 01:05 - 2010-08-27 01:05 - 01865344 _____ () C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe

2013-08-16 12:41 - 2012-04-05 11:33 - 00034304 _____ () C:\Windows\System32\ssi2mlm.dll

2013-08-18 19:11 - 2013-08-18 19:11 - 00677016 _____ () C:\Program Files\TortoiseGit\bin\libgit2.dll

2013-08-18 19:11 - 2013-08-18 19:11 - 00087704 _____ () C:\Program Files\TortoiseGit\bin\zlib1.dll

2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll

2013-08-26 17:16 - 2013-06-02 11:30 - 00717230 _____ () C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll

2012-06-28 09:34 - 2012-03-26 12:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-02-20 22:23 - 2012-02-20 22:23 - 00456704 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe

2012-02-20 22:23 - 2012-02-20 22:23 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll

2013-07-16 14:50 - 2007-05-31 08:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll

2014-02-03 12:13 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney Business 6.0\ouservice\PATCHW32.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 

Name: USB (Universal Serial Bus)-Controller

Description: USB (Universal Serial Bus)-Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/02/2014 02:01:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/30/2014 06:18:44 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/30/2014 03:17:38 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 02:39:14 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 02:15:34 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 09:57:44 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 05:45:20 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 05:10:33 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 04:45:06 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 03:39:02 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (06/02/2014 01:59:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Adobe Active File Monitor V6" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/30/2014 06:16:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Adobe Active File Monitor V6" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/30/2014 05:53:39 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 

Error: (05/30/2014 05:47:28 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 

Error: (05/30/2014 04:13:33 PM) (Source: SCardSvr) (EventID: 610) (User: )

Description: Das Gerät ist nicht angeschlossen.REINER SCT cyberJack pinpad/e-com USB 52GET_STATEXX XX XX XX
 

Error: (05/30/2014 03:15:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Adobe Active File Monitor V6" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/30/2014 09:17:56 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Server" wurde mit folgendem Fehler beendet: 

%%1062
 

Error: (05/30/2014 09:17:55 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 

%%1115
 

Error: (05/30/2014 09:17:51 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)

Description: Fehler beim Starten des Assistenten für das Sprachpaket-Setup. Führen Sie einen Neustart des Systems aus, und führen Sie den Assistenten erneut aus.
 

Error: (05/30/2014 09:17:51 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1000) (User: NT-AUTORITÄT)

Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007042d
 
 

Microsoft Office Sessions:

=========================

Error: (06/02/2014 02:01:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/30/2014 06:18:44 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/30/2014 03:17:38 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 02:39:14 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 02:15:34 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/28/2014 09:57:44 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 05:45:20 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 05:10:33 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 04:45:06 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/27/2014 03:39:02 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 31%

Total physical RAM: 8050.84 MB

Available physical RAM: 5511.43 MB

Total Pagefile: 16099.86 MB

Available Pagefile: 13575.67 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (System) (Fixed) (Total:454.57 GB) (Free:385.67 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 67C09533)

Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=464 GB) - (Type=OF Extended)
 

==================== End Of Log ============================

Vielen Dank für Deine Hilfe
Gruß Reinhard